Automattic Mongoose up to 6.13.11/7.8.12/8.24.6/9.11.3 Query Casting Query.prototype._castConditions numeric range comparison without minimum check

Summaryinfo

A vulnerability was found in Automattic Mongoose up to 6.13.11/7.8.12/8.24.6/9.11.3. It has been rated as problematic. Affected by this vulnerability is the function Query.prototype._castConditions of the component Query Casting. The manipulation leads to numeric range comparison without minimum check. This vulnerability is listed as CVE-2026-125119. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Automattic Mongoose up to 6.13.11/7.8.12/8.24.6/9.11.3. This issue affects the function Query.prototype._castConditions of the component Query Casting. The manipulation with an unknown input leads to a numeric range comparison without minimum check vulnerability. Using CWE to declare the problem leads to CWE-839. The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum. Impacted is confidentiality. The summary by CVE is:

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype._castConditions() and query casting check other option locations and do not read that configuration. An application that enables sanitizeFilter through mongoose.connect() or createConnection() and passes an attacker-controlled object into a query filter therefore receives a connection that reports the defense as enabled while query selector objects remain unsanitized. A crafted password value using a query operator can match an account record without the expected literal password, while global configuration through mongoose.set('sanitizeFilter') and per-query Model.find().sanitizeFilter() remain unaffected. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-125119 since 11/09/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

Upgrading to version 6.13.12, 7.8.13, 8.24.7 or 9.11.4 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Automattic

Name

• Mongoose

Version

• 6.13.0
• 6.13.1
• 6.13.2
• 6.13.3
• 6.13.4
• 6.13.5
• 6.13.6
• 6.13.7
• 6.13.8
• 6.13.9
• 6.13.10
• 6.13.11
• 7.8.0
• 7.8.1
• 7.8.2
• 7.8.3
• 7.8.4
• 7.8.5
• 7.8.6
• 7.8.7
• 7.8.8
• 7.8.9
• 7.8.10
• 7.8.11
• 7.8.12
• 8.24.0
• 8.24.1
• 8.24.2
• 8.24.3
• 8.24.4
• 8.24.5
• 8.24.6
• 9.11.0
• 9.11.1
• 9.11.2
• 9.11.3

Website

• Product: https://github.com/Automattic/mongoose/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion